REMARKS 

The Office Action dated July 28, 2008 has been received and carefully noted. The 
above amendments to the claims, and the following remarks, are submitted as a full and 
complete response thereto. 

Applicants gratefully acknowledge the indication in the Office Action that claims 
6-9, 13-15, 17, and 27 would be allowable if rewritten into independent form. However, 
as discussed below, Applicants respectfully submit that these claims are allowable in 
their present form. In accordance with the foregoing, claims 2-3, 24-26, and 32-36 have 
been amended to more particularly point out and distinctly claim the subject matter of the 
invention. The amendments are not necessitated by the prior art of record. No new 
matter is being presented, and approval and entry are respectfully requested. 

Claims 1-9, 13-15, 17, 21, and 23-38 are pending and under consideration. 

REJECTION UNDER 35 V.S.C. S 103: 

Claims 2-3, 24-26, and 32-38 were rejected under 35 USC §103(a) as being 
obvious in view of RFC 2977, U.S. Application No. 2002/0065785 to Tsuda ("Tsuda"), 
and U.S. Patent No. 6, 751,459 to Lee et al. ("Lee"). The Office Action took the position 
that RFC 2977, Tsuda, and Lee disclose all aspects of claims 2-3, 24-26, and 32-38. It is 
respectfully asserted that, for at least the reasons provided herein below, RFC 2977, 
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Tsuda, and Lee fail to teach or suggest the recitations of the pending claims. 
Reconsideration is requested. 

Independent claim 2, from which claims 37 and 38 depend, recites a method 
including receiving a message from subscriber's user equipment. The message indicates 
that an address of a certificate provisioning gateway for certificate issuance and delivery 
procedure in a visited network is requested by the subscriber's user equipment, the 
certificate provisioning gateway serving at least one certificate authority. The message 
further contains the address of the certificate provisioning gateway. The method includes 
obtaining, in response to receiving the message, subscriber's location information 
maintained in a mobile communication system, and determining on the basis of the 
subscriber's location information, an address of the certificate provisioning gateway. The 
method also includes checking whether or not the address of the certificate provisioning 
gateway received in the message is the same as the address of the certificate provisioning 
gateway determined on the basis of the location information. If they are not the same, the 
method uses the address determined on the basis of the location information. 

Independent claim 3 recites a method including receiving a message from 
subscriber's user equipment, the message containing subscriber's location information 
and indicating that an address of a certificate provisioning gateway for certificate 
issuance and delivery procedure in a visited network is requested by the subscriber's user 
equipment. The certificate provisioning gateway serves at least one certificate authority. 
The method also includes obtaining, in response to receiving the message, subscriber's 
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location information maintained in a mobile communication system, and checking 
whether or not the subscriber's location information received in the message corresponds 
to the subscriber's location information obtained. The method includes using the 
subscriber's location information obtained for determining the address of the certificate 
provisioning gateway if the subscriber's location information obtained does not 
correspond to subscriber's the location information received in the message. 

Independent claim 24, from which claims 6-9 and 13 depend, recites a method 
including receiving a message from subscriber's user equipment, the message containing 
subscriber's location information and indicating that an address of a certificate 
provisioning gateway for certificate issuance and delivery procedure in a visited network 
is requested by the subscriber's user equipment. The certificate provisioning gateway 
serves at least one certificate authority. The method includes obtaining, in response to 
receiving the message, subscriber's location information maintained in a mobile 
communication system. The method includes checking whether or not the subscriber's 
location information received in the message corresponds to the subscriber's location 
information obtained, and if the subscriber's location information obtained corresponds 
to the subscriber's location information received in the message, determining on the basis 
of the subscriber's location information the address of the certificate provisioning 
gateway. If the subscriber's location information obtained does not correspond to the 
subscriber's location information received in the message, the method sends an error 
indication by using the subscriber's location information obtained. 
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Independent claim 25, from which claim 27 depends, recites a method including 
receiving a message from subscriber's user equipment, the message containing 
subscriber's location information and indicating that an address of a certificate 
provisioning gateway for certificate issuance and delivery procedure in a visited network 
is requested by the subscriber's user equipment. The certificate provisioning gateway 
serves at least one certificate authority. The method includes obtaining, in response to 
receiving the message, subscriber's location information maintained in a mobile 
communication system, and checking whether or not the subscriber's location 
information received in the message corresponds to the subscriber's location information 
obtained. The method also includes determining, on the basis of the subscriber's location 
information the address of the certificate provisioning gateway, if the subscriber's 
location information received in the message corresponds to the subscriber's location 
information obtained. The method uses the subscriber's location information received in 
the message if the subscriber's location information received in the message does not 
correspond to the subscriber's location information obtained. 

Independent claim 26, from which claims 14, 15, and 17 depend, recites a method 
including receiving a message from subscriber's user equipment, the message containing 
subscriber's location information and indicating that an address of a certificate 
provisioning gateway for certificate issuance and delivery procedure in a visited network 
is requested by the subscriber's user equipment. The certificate provisioning gateway 
serves at least one certificate authority. The method includes obtaining, in response to 
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receiving the message, subscriber's location information maintained in a mobile 
communication system, and checking whether or not the subscriber's location 
information received in the message corresponds to the subscriber's location information 
obtained. If the subscriber's location information received in the message corresponds to 
the subscriber's location information obtained, the method determines on the basis of the 
subscriber's location information the address of the certificate provisioning gateway. If 
the subscriber's location information received in the message does not correspond to the 
location information obtained, the method sends an error indication by using the 
subscriber's location information received in the message. 

Independent claim 32 recites an apparatus, including a processor configured to 
serve a certificate authority in a mobile communication system and to determine, in 
response to receiving from subscriber's user equipment a message indicating a request for 
an address of another certificate provisioning gateway for certificate issuance and 
delivery procedure. The message further contains an address of the other certificate 
provisioning gateway, an address of the other certificate provisioning gateway on the 
basis of subscriber's location information maintained in and obtained from the mobile 
communication system. The processor is also configured to check whether or not the 
address of the other certificate provisioning gateway received in the message is the same 
as the address of the other certificate provisioning gateway determined on the basis of the 
subscriber's location information. If they are not the same, the processor is configured to 
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use the address of the other certificate provisioning gateway determined on the basis of 
the location information. 

Independent claim 33 recites an apparatus, including a processor configured to 
serve a certificate authority in a mobile communication system, and to obtain, in response 
to receiving from subscriber's user equipment a message containing subscriber's location 
information and indicating a request for an address of another certificate provisioning 
gateway for certificate issuance and delivery procedure in a visited network, subscriber's 
location information maintained in the system. The processor is also configured to check 
whether or not the subscriber's location information received in the message corresponds 
to the subscriber's location information obtained, and to use the subscriber's location 
information obtained from the system to determine the address of the other certificate 
provisioning gateway if the subscriber's location information obtained from the system 
does not correspond to the location information received in the message. 

Independent claim 34 recites an apparatus, including a processor configured to 
serve a certificate authority in a mobile communication system. The processor is 
configured to obtain, in response to receiving from subscriber's user equipment a 
message containing subscriber's location information and indicating that an address of 
another certificate provisioning gateway for certificate issuance and delivery procedure in 
a visited network is requested, subscriber's location information maintained in the 
system. The processor is configured to check whether or not the subscriber's location 
information received in the message corresponds to the subscriber's location information 

-20- 



obtained. If the subscriber's location information received in the message corresponds to 
the subscriber's location information obtained, the processor is configured to determine 
an address of the other certificate provisioning gateway on the basis of the subscriber's 
location information. If the subscriber's location information obtained from the system 
does not correspond to the subscriber's location information received in the message, the 
processor is configured to send an error indication by using the subscriber's location 
information obtained. 

Independent claim 35 recites an apparatus, including a processor configured to 
serve a certificate authority in a mobile communication system, and to obtain, in response 
to receiving from subscriber's user equipment a message containing subscriber's location 
information and indicating a request for an address of another certificate provisioning 
gateway for certificate issuance and delivery procedure in a visited network, subscriber's 
location information maintained in the system. The processor is also configured to check 
whether or not the subscriber's location information in the message corresponds to the 
subscriber's location information obtained. The processor is configured to use the 
subscriber's location information received in the message to determine the address of the 
other certificate provisioning gateway if the subscriber's location information received in 
the message does not correspond to the subscriber's location information obtained. 

Independent claim 36 recites an apparatus including a processor configured to 
serve a certificate authority in a mobile communication system. The processor is 
configured to obtain, in response to receiving from subscriber's user equipment a 
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message containing subscriber's location information and indicating a request for an 
address of another certificate provisioning gateway for certificate issuance and delivery 
procedure in a visited network, subscriber's location information maintained in the 
system. The processor is further configured to check whether or not the subscriber's 
location information received in the message corresponds to the subscriber's location 
information obtained, and to determine on the basis of the subscriber's location 
information the address of the other certificate provisioning gateway, if the subscriber's 
location information in the message corresponds to the subscriber's location information 
obtained. If the subscriber's location information received in the message does not 
correspond to the subscriber's location information obtained, the processor is configured 
to send an error indication by using the subscriber's location information received in the 
message. 

As will be discussed below, RFC 2977, Tsuda, and Lee fail to disclose or suggest 
the elements of any of the presently pending claims. 

As a preliminary matter, on page 3, the Office Action responded to the arguments 
submitting that Tsuda and Lee fail to cure the deficiencies of RFC 2977 by submitting 
that "one cannot show non-obviousness by attacking the references individually where 
the rejections are based on combinations of references," and cites In re Keller, 642 F.2d 
413, 208 USPQ 871 (CCPA 1981) and In re Merck & Co., 800 F.2d 1091, 231 USPQ 
375 (Fed. Cir. 1986). Applicants respectfully point out that the Office Action's reliance 
on In re Keller and In re Merck is misplaced. The arguments supporting the patentability 
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of the pending claims support the pattern laid out by the Federal Circuit: identify the 
deficiencies of the primary reference, and determine whether the secondary reference 
remedies those deficiencies. In re Rijckaert, 28 USPQ2d 1955, 1956-7 (Fed. Cir. 1993). 
Additionally, as the Federal Circuit has explained, Applicants are not required to show 
non-obviousness until a prima facie case for obviousness has been established. Rijckaert 
at 1957. Additionally, the arguments being presented do not address a reference in 
isolation, as done by the applicant in In re Merck, nor an affidavit is provided regarding a 
solitary reference like the applicant in In re Keller. Accordingly, Applicants respectfully 
submit that the arguments comply with the law as set forth by the Federal Circuit. 

Referring to the cited references, RFC 2977 generally describes a mobile IP and 
requirements which would have to be supported by an Authentication, Authorization, 
Accounting (AAA) service to aid in providing mobile IP services. The basic model 
described in section 3 of RFC 2977 includes a client belonging to one administrative 
domain (called home domain) having to use resources provided by another administrative 
domain (called foreign domain). An agent in the foreign domain that attends to the 
client's request (call the agent the "attendant") is likely to require that the client provide 
some credentials that can be authenticated before access to the resources is permitted. 
The attendant is expected to consult an authority (typically in the same foreign domain) 
in order to request proof that the client has acceptable credentials. 

RFC 2977 identifies the following requirements that have to be supported: Each 
local attendant has to have a security relationship with the local AAA server (AAAL), the 
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local authority has to share, or dynamically establish, security relationships with external 
authorities that are able to check client credentials; the attendant has to keep state for 
pending client requests while the local authority contacts the appropriate external 
authority; since the mobile node may not necessarily initiate network connectivity from 
within its home domain, it MUST be able to provide complete, yet unforgeable 
credentials without ever having been in touch with its home domain; and intervening 
nodes (e.g., neither the attendant or the local authority (AAAL) or any other intermediate 
nodes) MUST NOT be able to learn any (secret) information which may enable them to 
reconstruct and reuse the credentials. 

Tsuda generally describes a function for carrying out AAA processing and 
authentication and accounting processes carried out between AAA function (AAAM) on 
a mobile node and a visited network or the mobile node and a home network. See 
paragraph [0054]. When the mobile node is connected to the visited network, for 
example, the mobile node 1010 transmits a registration request to the home agent or the 
AAAH server according a Mobile IP protocol. See FIG. 1 and paragraphs [0061]-[0065]. 

Furthermore, Tsuda describes that a foreign agent sends periodically an 
advertisement including its own address (S101), and, thus, the mobile terminal receives 
the address without requesting . See , at least, FIGS. 10 and 11 of Tsuda. In Tsuda, when 
the mobile terminal notices that it has changed sub-network, it sends a registration 
request SI 02 to the foreign agent using the address the mobile terminal received in the 
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advertisement. Then, the mobile terminal is authenticated and keys changed, such keys 
being used to encrypt communication. 

Lee generally describes a method and apparatus for nomadic computing by means 
of transparent virtual networking, information storage, and mobility when the user is 
traveling from one location to another and/or using different computer platforms or 
operating modes. Personal mobility domain name service (PMDNS) is originally 
designed to provide personal mobility via a personal identifier. Because of generic 
system architecture which uses the Internet as backbone, interoperating with existing 
access networks, it is also wise to provide nomadic computing services. 

However, other than listing requirements, RFC 2977 does not teach or suggest that 
a message is received from a subscriber's user equipment, where the message would be 
configured to indicate "that an address of a certificate provisioning gateway for certificate 
issuance and delivery procedure in a visited network is requested by the subscriber's user 
equipment, the certificate provisioning gateway serving at least one certificate authority, 
the message further containing the address of the certificate provisioning gateway," as 
recited in independent claim 2 and similarly recited in independent claims 3, 24-26, and 
32-36. RFC 2977 does not provide a message that would indicate an address of a 
certificate provisioning gateway for certificate issuance and delivery procedure in a 
visited network. The description provided in RFC 2977 of various listings of 
requirements to roaming and related to basic IP connectivity, would not enable a person 
of ordinary skill in the art to arrive at the claimed invention. Section 4 of RFC 2977 
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simply lists requirements on AAA services including AAA server MUST be able to 
obtain or to coordinate the allocation of, a suitable IP address for the customer, upon 
request by the customer; and AAA servers MUST be able to identify the client by some 
means other than its IP address. However, there is no teaching or suggestion regarding 
the address of a certificate provisioning gateway for certificate issuance and delivery 
procedure in a visited network is requested by the subscriber's user equipment. 

Also, section 5 of RFC 2977 is limited to submitting that the AAA server MUST 
also be able to validate certificates provided by the mobile node and provide reliable 
indication to the foreign agent. However, similar to other portions of RFC 2977, section 
5 does not teach or suggest the particular features of independent claim 2 reciting the 
"address of a certificate provisioning gateway for certificate issuance and delivery 
procedure in a visited network is requested by the subscriber's user equipment." 
Furthermore, neither section 3-5 of RFC 2977 teach or suggest, at least, "determining on 
the basis of the subscriber's location information, an address of the certificate 
provisioning gateway," as recited in independent claim 2 and similarly recited in 
independent claims 3, 24-26, and 32-36. 

RFC 2997 fails to teach a certificate provisioning gateway (and a certificate 
authority), and, therefore, it cannot disclose any feature relating to the certificate 
provisioning gateway. 

If home/foreign authorities are considered as certificate provisioning gateways, 
although not admitted or suggested to have that kind of functionality by RFC 2977, the 
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user equipment need not request for their addresses according to the description of RFC 
2977. The user equipment knows its home authority address. Further, the user 
equipment establishes no direct connection to a foreign authority but uses an attendant, 
whose address the user equipment knows (otherwise, the user equipment could not send 
any messages to attendant and the user equipment would not obtain a service). The 
attendant then provides different services in the foreign network, the services including 
contacts to home authority. According to RFC 2977, the address of the attendant is the 
only address needed for the foreign network. 

As correctly recognized by the Office Action, RFC 2977 fails to teach or suggest, 
"checking whether or not the address of the certificate provisioning gateway received in 
the message is the same as the address of the certificate provisioning gateway determined 
on the basis of the location information; and if they are not the same, using the address 
determined on the basis of the location information," as recited in independent claim 2 
and similarly recited in independent claims 3, 24-26, and 32-36. To resolve the 
deficiencies of RFC 2977, the Office Action relied on Tsuda and Lee. However, as will 
be discussed below, Tsuda and Lee fail to cure the deficiencies of RFC 2977. 

However, similar to RFC 2977 alone, a combination of RFC 2977, Tsuda, and Lee 
would not teach or suggest all the recitations of independent claims 2, 3, 24-26, and 32- 
36. For instance, RFC 2977, Tsuda, and Lee are silent as to teaching or suggesting, at 
least, "receiving a message from subscriber's user equipment, said message indicating 
that an address of a certificate provisioning gateway for certificate issuance and delivery 
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procedure in a visited network is requested by the subscriber's user equipment, the 
certificate provisioning gateway serving at least one certificate authority, the message 
further containing the address of the certificate provisioning gateway; obtaining, in 
response to receiving the message, subscriber's location information maintained in a 
mobile communication system," as recited in independent claim 2. In addition, Tsuda 
and Lee do not teach or suggest that a message is received from a user equipment 
requesting the address of a network element. Rather, Tsuda describes sending from a 
network node advertising messages containing an address without any request from the 
user equipment. 

Also, Tsuda discloses that AAA servers are for authentication, authorization, and 
accounting, (See paragraph [0004]) and that AAA-H server locates in a home network 
and AAA-F server in a visited network. Further, Tsuda discloses in paragraph [0186] a 
certificate authority as a separate entity, not included in the AAA servers, and states that 
the certificate authority may be used in addition to the AAA servers. Thus, Tsuda 
describes that AAA-servers cannot be interpreted as certificate authorities. Lee is 
completely devoid of any teaching or suggestion regarding AAA servers and certificate 
authorities. 

On page 3 of the Office Action, it is submitted that "the mere disclosure of 
certificate authorities being used is enough to reject the claim since any user of said CA 
[certificate authorities] would inherently require the designer to include a process 
whereby they are used to obtain certificates, thus they could be a standalone entity or 
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incorporated into the AAA server." However, as commonly understood, the Examiner 
bears the burden of establishing a prima facie case of obviousness based upon the prior 
art... "[the Examiner] can satisfy this burden only by showing some objective teaching in 
the prior art or that knowledge generally available to one of ordinary skill in the art would 
lead that individual to combine the relevant teachings of the references." In re Fritch , 23 
USPQ 2d 1780, 1783 (Fed. Cir. 1992). In addition, the mere fact that the prior art may be 
modified in the manner suggested by the Examiner does not make the modification 
obvious unless the prior art suggested the desirability of the modification. Id. at 1783-84 . 
"One cannot use hindsight reconstruction to pick and choose among isolated disclosures 
in the prior art to deprecate the claimed invention." In re Fine , 837 F.2d 1071, 1075, 5 
USPQ 2d 1596, 1600 (Fed. Cir. 1988). Therefore, the basis for arriving to the claimed 
features is improper. As previously indicated, Tsuda describes that AAA-servers cannot 
be interpreted as certificate authorities. Also, paragraph [0186] of Tsuda, which the 
Office Action refers, simply provides that "it is also possible to carry out the 
authentication of the correspondent terminal or the user by using the public key 
information or the certificate authority in addition." However, Tsuda does not teach or 
suggest how the certificate authority can be configured in addition to the checking the 
host name to carry out authentication. Contrary to the improper conclusory contentions 
made in the Office Action, it would not be possible for a designer or a person of ordinary 
skill in the art to configure "checking whether or not the address of the certificate 
provisioning gateway received in the message is the same as the address of the certificate 
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provisioning gateway determined on the basis of the location information; and if they are 
not the same, using the address determined on the basis of the location information," as 
recited in the present claims when Tsuda is completely silent as to such functions, except 
for the general and vague contention that certificate authority may be used for 
authentication. 

Applicants respectfully request that a clear explanation be provided on how a 
combination of Tsuda, Lee and RFC2977 could teach what to do if they (location 
information, or addresses) do not correspond to each other, when the examiner admits 
that the feature is not taught by cited references. 

Applicants also respectfully request a clear explanation how identifying a user 
address and deciding whether or not to contact the home domain, discloses checking 
whether the received address is the same as the determined one, or checking whether the 
received location information corresponds to the obtained location information. 

Furthermore, independent claim 2 recites a certificate issuance and the certificate 
provisioning gateway serving at least one certificate authority, whereas Tsuda and Lee 
relates to routing services. Tsuda and Lee describes how to find a mobile terminal when 
the terminal has a fixed IP address used as its identification, but the actual IP address of 
the terminal depends on the terminal's location. Clearly, RFC 2977, Tsuda, and Lee are 
silent as to teaching or suggesting that a user equipment could use a certificate issuance 
services of a visited network, or of another network than a home network of the user 



-30- 



equipment. On the contrary, Tsuda describes for example in paragraph [0056] to always 
contact the AAA server in the home network to authenticate the user. 

Furthermore, certificate authorities are provided as separate entities in the present 
application, and for one skilled in the art a certificate authority is a trusted third party 
issuing certificates. Thus, one skilled in the art would not interpret an authentication, 
authorization, and accounting server as a certificate authority issuing certificates, and 
none of the cited references describe such feature. 

A combination of RFC 2977, Tsuda, and Lee would teach away from the claimed 
invention because the combination would teach all network-related data should be sent in 
advertise messages. As done in the Office Action, providing that a combination of RFC 
2977, Tsuda, and Lee would teach the recitations of the claims is purely based on 
hindsight. "To support the conclusion that the claimed combination is directed to 
obvious subject matter, either the references must expressly or impliedly suggest the 
claimed combination. It is to be noted that simplicity and hindsight are not proper criteria 
for resolving the issue of obviousness." Ex Parte Clapp, 227 USPQ 972, 973 (B.P.A.I. 
1985). 

Regarding independent claims 6 and 14, paragraph [0069] of Tsuda generally 
describes accounting and disclosing how subscribers are billed and paragraph [00186] of 
Tsuda describes that public key information or certificate authority may be used in 
addition to authentication. However, Tsuda fails to teach or suggest that "an address of a 
certificate provisioning gateway via which the certificate issuance service is provided in 
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the other network, the certificate provisioning gateway serving at least one certificate 
authority, a public key required for the certificate issuance service in the other network, 
and an indication of the protocol required for the certificate issuance service in the other 
network," as recited in independent claims 6 and 14. RFC 2977 and Lee are devoid of 
any teaching or suggestion providing such features. Based on the description of Tsuda, 
the certificate authority used locates the home network, or the public key is used for the 
home network, and, therefore, one skilled in the art would assume that they are stored in 
the user equipment. 

In view of the descriptions of Tsuda and Lee, these references do not cure the 
deficiencies of RFC 2977. A combination of RFC 2977, Tsuda, and Lee would fail to 
teach or suggest all the recitations of the present claims. Instead, the combination of RFC 
2977, Tsuda, and Lee would simply list requirements that need to be supported by a AAA 
service to aid in providing mobile IP services, where the mobile IP network could have 
home zone information and provide home zone services in a subnet using an address of 
AAAH. However, there is no teaching or suggestion in the combination of RFC 2977, 
Tsuda, and Lee checking whether or not the address of the certificate provisioning 
gateway received in the message is the same as the address of the certificate provisioning 
gateway determined on the basis of the location information; and if they are not the same, 
using the address determined on the basis of the location information. 

Accordingly, in view of the foregoing, it is respectfully requested that independent 
claims 2, 3, 24-26, and 32-36 and related dependent claims be allowed. 
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CONCLUSION: 

In view of the above, Applicant respectfully submits that the claimed invention 
recites subject matter which is neither disclosed nor suggested in the cited prior art. 
Applicant further submits that the subject matter is more than sufficient to render the 
claimed invention unobvious to a person of skill in the art. Applicant therefore 
respectfully requests that each of claims 2-3, 24-26, and 32-38 be found allowable and, 
along with allowed claims 6-9, 13-15, 17, and 27, this application passed to issue. 

If for any reason the Examiner determines that the application is not now in 
condition for allowance, it is respectfully requested that the Examiner contact, by 
telephone, the applicant's undersigned attorney at the indicated telephone number to 
arrange for an interview to expedite the disposition of this application. 
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In the event this paper is not being timely filed, the applicants respectfully petition 
for an appropriate extension of time. 



Customer No. 32294 

SQUIRE, SANDERS & DEMPSEY L.L.P. 
14 th Floor 

8000 Towers Crescent Drive 
Vienna, Virginia 22182-6212 
Telephone: 703-720-7800 
Fax: 703-720-7802 

AMC:dk 

Enclosures: RCE 

Petition for Extension of Time 
Check No. 20033 



Respectfully submitted, 




Alicia M. Choi / 
Attorney for Applicants 
Registration No. 46,621 



-34- 



